Goals
a. Perform an audit of a deviation management system
b. Use a range of tools and information, including the contents of this unit to support the audit of a deviation management system
c. Understand and apply appropriate GMP standards/regulations and In-house standards to an audit of a deviation management system
d. Recognize compliance or non-compliance of deviation management systems to applicable regulations
Definitions
Corrective Action : An action taken to correct or eliminate the causes of an existing deviation, issue, incident or problem. A corrective action must typically be completed before the disposition of any implicated materials can be determined.
Deviation: Departure from a process/procedure or an unexpected result.
Investigation: A formal and documented review of a deviation, issue, incident or problem, to identify its root cause and determine the actions required to address it.
Laboratory Error : Incorrect performance of one or more of the steps of an analytical procedure and/or any identifiable laboratory related problem such as malfunctioning equipment, etc.
Out of Specification Test Result (OOS): A laboratory test result that is outside its regulatory or compendial limits. In some cases, there may be additional tests and/or limits that are used to assess the quality of a material, but are not included in registrations or compendia. In these cases, the general principles described here are useful, but more latitude is allowable in the disposition of the material as long as it meets its legal requirements.
Out of Trend Test Result (OOT): A laboratory test that is within its regulatory or compendial limit but is atypical of previous results for the test over a number of batches or earlier time points in a stability study and may provide early indication of a potential OOS result.
Overdue Investigation: If after 30 working days of the incident, neither an interim nor final investigation report has been approved, the investigation is overdue.
Preventative Action/Measure: An action taken to prevent recurrence or to pre-empt a potential issue, deviation, incident or problem.
Process Capability: A statistical indicator that measures how well a given process is running. It compares the actual variability in the process to the process specification.
Reanalysis (New Initial Test): A test performed on the original sample (where possible) following invalidation of a test for a determinant error.
Repeat deviation: A deviation that re-occurs after the identification of actions identified from a previous deviation. This would indicate that the root cause of the previous incident had not been correctly identified and/or that the actions determined had either not been taken in a timely manner, or had not effectively addressed the root cause.
Reportable Result(s): The final value(s) that will be reported as representing the outcome of the analysis derived from the data. It is the value compared to the specifications.
Resample: To take additional test samples from the same lot of material previously tested.
Retest: To perform additional testing on the original sample (where possible) or new original sample according to an investigative plan, when no determinant error is found.
Root Cause: The basic cause of a deviation, from which effective actions can be defined to prevent recurrence.
Trend: A determination that data is moving in a general direction based on the reoccurrence of events within a defined period of time.
Undetermined laboratory error: A situation where the laboratory investigation is inconclusive and the possibility remains that a laboratory error has eluded the investigation process.
Explanation of Topic
Introduction
During manufacturing, unplanned events or incidents may occur. These events are considered deviations from established processes, procedures and policies possibly placing the product out of compliance with regulatory requirements and jeopardizing the safety, purity and effectiveness of the drug product.
Deviations may be referred to by many different names such as atypical events, discrepancies, problems, abnormal occurrences, events or incidents.
There must be a deviation management system in place to determine the extent of the deviation, the impact of the deviation and to investigate why the deviation occurred and what can prevent it from reoccurring.
The goal of this training module is to describe how to audit a deviation management system using the appropriate GMP standards. The GMP requirements detailed in this module should be applied to the supplier on a sliding scale, the scale being dependent on the product or service being audited. In addition, the auditor should consider the risks associated with an unplanned incident that would potentially result in product not meeting customer specifications or regulatory requirements.
The principles outlined in this module can apply to a quality management system based on ISO 9001 or other similar systems as well as GMP. An example of a supplier where this might be the case is a supplier of a Non-contributory raw material.
It is, however recognized that there are differences in nomenclature and the requirements between ISO 9001 and GMP. For example, a deviation in a quality system based on ISO is often identified or defined as a ‘non-conformance’. A ‘non-conformance’ or ‘non- conforming product’ can be:
a. Product not meeting specification.
b. Customer rejects or complaints.
c. Results of inspections or in-process testing failures.
d. Unexplained event or observation.
Refer to ISO 9001 standards for additional nomenclature and requirements of ISO quality systems for managing non-conformances.
Types of Deviations
Deviations are usually divided into two major categories. The first category includes events that deviate from the process described in approved SOPs that may affect product quality. An event is also considered a deviation when an unexpected result is obtained even though the process was followed correctly.
The second category includes laboratory out of specification (OOS) or out of trend (OOT) results. OOS or OOT results may be caused by laboratory errors, incorrect testing procedures or compromised samples, material within specification but outside of process capability, or material out of specification. Auditing a laboratory system for investigating OOS or OOT results is addressed in the OOS and OOT Test Results section.
Shown below are recognized deviations that are considered part of a deviation management system:
Recognized Deviations Include
Process deviations, including deviations from time limits, production and process control procedures
Equipment Out of Tolerance
Failures of the Quality System
Any incident or event that leads to rejection of the lot or any component or failure to meet specifications
Laboratory Out of Specification
Water System Microbial Out of Specification
Automation malfunctions
Deviations from lab standards, sampling plans and test procedures
A few examples include:
Ø A foreign tablet in another lot of tablets
Ø A ruptured equipment hose
Ø Time exceeded during processing
Ø Failure to follow standard operating procedures
Ø An in-process testing result not meeting specifications
Ø Wrong packaging material used to package a lot
Ø Wrong expiration date printed on finished product
Ø Incorrect amounts of material charged to a tank
Ø Discrepancies in label reconciliation
System for Managing Deviations
The company or site should have a system detailed in an approved SOP for managing deviations. The SOP should establish a system and procedure to identify, investigate and document root causes of a deviation. The SOP should include:
Ø Who should be notified once a deviation has been detected
Ø How the appropriate personnel should be notified
Ø Who initiates and manages the investigation to determine the cause of the Deviation
Ø Requirements for management review
Ø How an investigation to determine root cause should be performed
Ø What data should be examined during the investigation
Ø What the immediate corrective actions are
Ø What the retention time is for keeping investigation reports
Ø Who should approve the final report
Ø What material and/or lots should be considered /impact on associated batches
Ø Roles and responsibilities for various departments
Ø Who should follow up on implementation of corrective or preventive actions
The deviation management system should encompass the manufacturing, testing, control, and distribution of finished drug products and materials.
The SOP should also include information about trending deviations. Deviations should be analyzed for trends. If a shift or trend is detected, it should be communicated to management and the department where the deviation has taken place.
Roles and Responsibilities for Investigating a Deviation
Many departments or functions may be involved in the process of investigating a deviation. Each may play a different part. Specific roles are outlined below.
Originator of the deviation
The department or function where the deviation was found/discovered is usually considered the “owner” of the deviation. As such, the owner has the responsibility to investigate the cause of the deviation, analyze data surrounding the investigation, and determine what actions can be taken to correct and/or prevent the deviation from reoccurring. The originator is also responsible, according to site procedure, for writing up the investigation report.
Quality Assurance (QA)
Because QA is responsible for determining the disposition of a product, it needs to be involved in the investigation process. QA should be notified immediately when a deviation is detected. Management and Quality Assurance are responsible for approving conclusions and actions taken or identified as a result of an investigation. It is also the responsibility of Management and/or Quality Assurance to ensure that appropriate communication with other impacted functions/sites has taken place as well as to provide copies of final (and interim) reports as appropriate. QA is also expected to oversee the investigation and ensure that it is adequate. The department responsible for the deviation is expected to conduct the investigation. QA should review and approve all deviation investigations associated with all batches of manufactured product prior to releasing product batches.
Other functions or departments
Depending on the extent of the deviation, it may impact other batches of product or other products. Other departments may provide data and information to be used in the investigation. An example might be a pump breaking in an aseptic area. Environmental monitoring data may be examined to ensure that the filling environment was within specification during the incident. In the case of an OOS, product lots that are not directly impacted by OOS results but are linked to the root cause should be identified and evaluated.
Additional departments that may be included in the investigation are Purchasing, Technical Operations, Stability, Regulatory Affairs and/or other departments depending on the type of investigation.
Your Role as an Auditor
As an auditor your job is to determine if there is a robust system for handling deviations, if deviations have been sufficiently investigated according to the site’s procedure and if a cause has been determined to prevent the deviation from recurring. Typically this determination will include reviewing examples of deviations. Consider that all deviations may not need to be investigated to the same level. The level of investigation may depend on the significance of and risk associated with the incident, problem or deviation.
Investigation Components
Many times a complete or full investigation is necessary. The following steps should be taken when conducting a full investigation.
A. Defining the problem
The investigation begins with a description of why the incident is a problem, written as a statement of facts, not assumptions. The problem is characterized by specifically addressing the questions who, what, when, where, and how.
B. Identification of probable causes
The probable root causes of some deviations are easily identified. For other deviations the root causes may not be easily identifiable, and, in the case of repeat deviations, previous attempts to solve the problem may have been unsuccessful. To ensure adequate corrective and preventive actions are developed and implemented, this step in the process deserves significant effort.
The probable causes are identified during a review of the following, as appropriate,
o Raw materials
o Packing components
o Processing/operations errors or problems
o Procedures
o Equipment and instruments
o Environmental conditions
o Supporting utilities
o Personnel
o Validation status
o Stability/impurity profile
o Testing
C. Investigation of each probable root cause
Each probable root cause is evaluated. In addition to interviewing associated personnel and reviewing records, investigative tools such as Cause and Effect diagrams (fishbone or Ishikawa diagrams), Relations Diagram, Brainstorming, and the five “WHYs?” may be used.
D. Analysis of information and identification of root cause
Information is reviewed for positive correlation to the problem and the probable causes are narrowed down to identify the actual root cause. Data analysis must be objective and logical.
E. Determination of the extent of the problem
The extent of the problem is determined by evaluating the effect of the deviation on other processes, products and batches. For clinical trial material, impact on the integrity of the clinical trial data is also considered.
F. Recommendations for the affected batch
The batch disposition and investigation conclusion is ascertained by evaluating the significance of the cause and the Quality, Regulatory and Compliance impact of the deviation.
Evaluation of Quality impact considers,
o Product safety and integrity
o Product purity and efficacy
o Product stability
o Customer perception and potential complaints
Evaluation of Regulatory impact considers,
o Any deviations from regulatory commitments and any resulting regulatory reporting requirements
Evaluation of Compliance impact considers,
o GMP violations or deviations from regulatory guidance
o Revalidation/re-qualification requirements
G. Corrective and Preventive Actions
Corrective actions are developed to support the affected batch(es) by correcting or eliminating the causes of the deviation. Preventive actions are developed to avoid recurrence. Both corrective and preventive actions are listed with targeted timeframes for implementation, are assigned a responsible person, and must be monitored to completion.
H. Documentation and Approval
Reports should be well-organized and easily understandable by a third party. Supporting documents should be attached, unless referenced as controlled documents. Casual e-mails should be avoided.
Investigation reports should include basic information:
o Unique identification number
o Date deviation reported
o Product, potency, lot number
o Processing step or phase of operation
o Important dates such as manufacturing, packaging, labeling & testing
o Identification of materials used in the batch and equipment/instruments used for manufacture/testing
Investigation reports and associated data is reviewed and approved by Quality and Management and are typically completed within 30 working days. If additional data is required to determine the disposition of the lot and the investigation cannot be completed within 30 working days, provisions should be in place to document and approve any necessary extensions.
Reports must be approved prior to QA release of material.
I. Tracking Corrective and Preventive Actions
A system should be in place to track implementation of corrective and preventive actions. Typically, corrective actions are completed prior to the lot release while preventive actions are implemented after release. Any extension of the agreed implementation date should be approved.
J. Trending root causes
A system should be in place to detect any trends associated with deviations and root causes. A procedure should clearly define what the site considers a trend and the steps to follow if a trend is detected. Trends may be identified according to product, root cause and/or GMP systems.
Each site should have an understanding of its key deviation issues. Operations sites might use Process Behavior Charts (PBCs) to trend key parameters.
Recurring problems may indicate that the root cause(s) were not completely identified and/or that preventive actions were not effective. A system should be in place to report significant or recurring problems to management.
Regulatory Expectations for Laboratory Testing
Since laboratory test results are used to release product, any out of specification (OOS) result must be thoroughly examined and investigated. FDA expectations, based on the
Barr laboratories legal decision in 1992, are that:
Ø A test result not meeting specification will be highlighted and investigated (usually within 30 working days)
Ø The word “failure” means any out of specification (OOS) result
Ø Product can not be “tested” into compliance
Ø Companies cannot average passing and failing test results to obtain a passing result
Ø Retesting is not the first action to occur after an OOS is generated
Ø Failing test results are not automatically discarded because they are assumed to be laboratory error
Ø Initial test results cannot be discounted after retesting different parts of the batch
Ø Companies can not discard initial failing results when passing retest results are achieved
Out of specification (OOS) and Out of trend (OOT) test result
Out of specification test results can be obtained when materials and finished product are tested. They can also be obtained during stability testing. The testing can be chemical, physical or microbiological.
When the analyst reports an initial OOS, the laboratory supervisor or designee will conduct a limited investigation. The supervisor or designee will try to determine if the result could be a result of an instrument malfunction, an error by the analyst or a lab error. This investigation must be documented. The original samples and test solutions should be kept until all testing is completed and approved to confirm or eliminate these possible causes of errors.
To eliminate probable causes the supervisor or designee should:
Ø Verify analyst’s knowledge of and performance of correct procedure including rechecking all calculations
Ø Examine raw data and identify anomalous or suspect information
Ø Confirm performance and calibration of instruments and system suitability requirements
Ø Verify that appropriate reference standards, solvents, reagents and other solutions were used and met QC specs and expiration dates
Ø Verify that the test method was performing to standard
Once all of the data is gathered from this limited or preliminary investigation, all findings are documented, preserving all evidence.
If lab error is determined as the cause, depending on the error, the laboratory should follow an approved procedure describing under what conditions must be met for a lot should be retested or re-sampled. For each deviation a pre- approved testing plan should be determined. All data should be retained. If re-testing is required, re-test results may substitute for original test results with original results retained and cause documented.
Documentation includes initialing and dating by involved person. If a laboratory result is to be invalidated, the laboratory should provide documented proof and justification for invalidating the result. In addition, the investigation should extend to other samples that may have been tested by the same analyst or using the same equipment.
If the original sample is judged to have been prepared improperly or not representative of the batch, the batch may be re-sampled using the same procedure and method as the original sample according to a pre-approved testing and sampling plan. If the original sample was not sampled correctly or the sampling method was in error, a new accurate method should be developed, qualified and documented. Other batches using the previous faulty sampling method will be assessed.
If the initial laboratory investigation is inconclusive, the possibility exists of an undetermined lab error and a pre-approved extensive retesting program may be initiated.
Once the lab error is eliminated as the cause and the Out of Specification result has been confirmed, the investigation now becomes a full or manufacturing investigation. It then follows the investigation procedure indicated in the “Investigation Components” section of this document.
In the case of an inconclusive manufacturing investigation, the possibility still remains that a laboratory error eluded the OOS investigation process. The investigation may return to the laboratory to further investigate the possibility of an undetermined lab error.
OOS investigations should be periodically evaluated for trends.
Some of the principles described here are applicable to observed OOT results. OOT results should be documented and there should be an initial laboratory assessment to see if there is evidence of a laboratory error. Retesting may be appropriate if a confirmed laboratory error is found, otherwise the result is accepted. The assessment and implications should be documented.
Summary
Incidents during manufacturing and testing may occur that can affect the quality attributes of a drug product. These deviations must be acknowledged, analyzed and investigated to determine the root cause. There should be a defined system in place to manage deviations.
Investigations should explore all possibilities and eliminate those that are not supported by data. Investigations should follow a prescribed format and determine root cause. Once the root cause has been determined and a conclusion drawn, the company should implement corrective and preventive actions to prevent the same incidents from happening again. These corrective actions/preventive actions should be tracked with implementation status being communicated to management.
Key Parameters for Auditing a Deviation Management System
Prior to the audit
a. Determine what manufacturing processes are used at the site.
b. If available, review the list of deviations generated at the site or company.
c. Review complaints to ensure that corresponding investigations are in place, as applicable.
During the audit
Ensure that the site has a robust system described in an approved SOP for management and investigation of manufacturing deviations and OOS test results.
Ensure that the SOP includes:
Ø How investigation tracking numbers are generated and assigned.
Ø What the time limit is for the investigation (usually working days).
Ø How and when quality is notified, usually within 24 hours, once a deviation is confirmed.
Ø What steps to take if an investigation is not completed within the defined timeframe.
Ø The criteria and requirements for a pre-approved plan for retesting.
Ø Guidance in determining what information must be examined to determine root cause.
Ø All GMP areas including in-process material and finished product.
Ø A review of deviation data on a periodic basis, within a defined timeframe, to identify trends.
Request a list of deviations/OOS, including trend reports. Review Process Behavior Charts and deviation KPIs, if available, to give insight into key deviation issues.
Ensure the SOP is followed by verifying through a review of a few deviation investigations that:
Ø A unique tracking number is assigned to each investigation.
Ø Deviations found in all GMP areas including in-process material and finished product are investigated according to SOP.
Ø Quality is notified in a timely manner (within a specific timeframe, e.g., 24 hours) as to lots affected
Ø A procedure is clearly described to manage the deviation investigation.
Ø The investigation has a 30 working day time limit for completion.
Ø Investigations not completed within the directed timeframe followed the SOP.
Ø Other manufactured product lots or products that might be affected by the deviation were investigated.
Identify any trends and determine how the site addresses them.
Verify that the date the deviation occurred and the date the deviation was detected was a minimal time.
Ensure that the investigation report includes:
Ø A written, factual description of the event, including the product name and lot number involved in the event, the date and time of the event, the extent that the product lot was affected.
Ø An assessment of other affected product and any lots that could potentially be impacted.
Ø The true root cause while eliminating, with proof, other causes. If the true root cause is unable to be determined then the most probable cause is investigated.
Ø Clear corrective and preventive actions based on the conclusion of root cause.
Ø Assignment of a responsible party and completion date for both the corrective action and preventive action.
Ø Disposition information about the lot as supported through data.
Ø A due date for completion of the investigation activities.
Ø Supporting documentation.
Ø Approval by a quality representative as well as other appropriate parties.
Ensure that there is a system in place that verifies that corrective actions have been implemented by their due date.
Ensure that before the batch is released the investigation has been approved by quality.
When reviewing OOS investigations,
Ø Verify that averaging practices for laboratory testing data do not hide data variability and conform to regulatory expectations.
Ø Verify that lab data is invalidated based on sound scientific rationale.
Ø Verify that retesting was appropriate and that an appropriate test plan was generated and followed. It is important that this test plan be clearly defined in the SOP and followed without variation.
Ø Verify that laboratory personnel are aware of potential problems and do their best to prevent them.